Who’d fake an executive’s LinkedIn profile page? Bad actors, of course. 

LinkedIn scams that target the public accounts of executives are on the rise and contributed to more than 40% of all phishing and social media cyber incidents in the second quarter of 2022.

Executive impersonation is nothing new. And it’s easily done. A scammer can obtain, either via purchase or data breach, an executive’s LinkedIn username and password on the dark web (where seven in ten passwords are freely available). Or, they can simply create a fake account with a username similar to the executive’s, borrow a profile pic from the corporate “Leadership Team” page – and quickly build a fake. 

Why cybercriminals impersonate executives LinkedIn profiles

Using the account, the scammer can carry out multiple nefarious actions:

  • They can reach out to the victim’s contacts to request financial support.
  • They can use social engineering techniques to convince the executive’s contacts to share sensitive information which can then be used for identity theft.
  • If they harbor a personal grudge or want to be truly malicious, they can post controversial content in the executive’s name.

These scams are a growing problem for executives, but they are also a headache for CISOs and CSOs. Here’s why:

Time on task (with no guarantees)

Faced with a rapidly evolving threat landscape, the priority for any CISO is to assess and mitigate security problems that impact the enterprise – not an executive in their private digital life. But, since social media inhabits the digital realm, when things go wrong (such as a LinkedIn scam), the CISO and their team are frequently asked to step in to remove the fake account(s). And that is easier said than done.

Many businesses lack the budget or tools to monitor for fake social media accounts in their executives’ names. And, when they find them, reporting an imposter to the LinkedIn powers-that-be is a lengthy process. In fact, the reporting party must prove the authenticity of the executive (including uploading a government ID – a risk-laden step in itself) and hoping for the best, by which point it may be too late and the damage is done.

Keeping employees from being duped

The fake LinkedIn profile of an executive – or even another company’s executive, such as a business partner or vendor – can also be used by social media scammers to target the company’s employees. Most people quickly glance at their mobile device and see a picture and a name and assume that person is authentic and well-meaning – making them vulnerable to social engineering. Of course, the time-consuming task of hardening employees to help prevent these attacks falls on the CISO.

Brand and reputation matter

Employees are not the only ones who can be duped by a fake executive LinkedIn account. If a prospective job seeker is misled by a profile that claims to be an executive recruiter for a company or a customer responds to a fake persona – the public’s trust and confidence in the company’s brand can be shaken.

Protect executive’s personal LinkedIn accounts, protect the company

LinkedIn has released new security features to help combat fake executive profiles. According to an article in Bleeping Computer, “The first step to fighting fake accounts on LinkedIn is introducing a new “About this profile” section that gives users information like when the user created their profile, if the holder has verified their number, and if they linked a work email.

A social media behemoth like LinkedIn taking digital privacy and security seriously is a very good sign. However,  no new feature will immediately solve such a widespread problem. And as we know, cybercriminals always adapt their methods in response to tightening controls. 

To help reduce your risk, check out this blog for tips on how to spot social media spoofs. But for true peace of mind, click here to speak with a BlackCloak representative about implementing a digital executive protection strategy at your company. 

We remove PII from nearly 200 data broker websites. We constantly scan the dark/deep web for data leaks. Additionally, we review and suggest changes to both social media privacy settings and device privacy settings. 

Doing so makes it significantly more difficult for cybercriminals to obtain the credentials and information needed to pull off realistic executive impersonations on LinkedIn and other social media platforms.